The present invention relates to a method and apparatus for use in analysing network data, and in one example to analysing network data to determine nodes predicted to exhibit behaviour of interest.